3884 matches found
CVE-2018-12533: Improper Neutralization of Special Elements used in an Expression Language Statement
JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language EL expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310...
Online Store System CMS SQL Injection Vulnerability
Online Store System CMS is an online management system. A SQL injection vulnerability exists in Online Store System CMS, which can be exploited by an attacker to execute arbitrary SQL commands...
CVE-2017-18288
An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the GET game parameter...
JB Tour Booking SQL Injection Vulnerability in Joomla!
Joomla! is an open source content management system CMS developed by the Open Source Matters team in the U.S. JB Tour Booking is one of the scripts designed for travel agencies. A SQL injection vulnerability exists in Joomla JB Tour Booking. An attacker could use this vulnerability to corrupt the...
SQL Injection Vulnerability in Guangzhou Lianya Network Technology Co.
Guangzhou Lianya Network Technology Co., Ltd. is a technology-based network company. A SQL injection vulnerability exists in the website building system of Guangzhou Lianya Network Technology Co. An attacker can exploit the vulnerability to obtain sensitive information from the database...
Zechat has multiple vulnerabilities
Zechat is a PHP-based online chat application script . Zechat suffers from SQL injection and cross-site request forgery vulnerabilities. An attacker can exploit the vulnerabilities to obtain sensitive information about the database; change the user's information...
SQL Injection Vulnerability at lmxcms Tags Search
Dream Cms, hereinafter referred to as "lmxcms", is a simple and practical website management system cms developed by "10 years" screen name. A SQL injection vulnerability exists in lmxcms Tags search. An attacker can exploit the vulnerability to obtain sensitive information from the database...
Drupal Automated Logout Module HTML Injection Vulnerability
Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. An HTML injection vulnerability exists in Drupal's Automated Logout module that stems from a failure to adequately validate user input. An attacker could exploit this...
SQL Injection Vulnerability in KuaiFanCMS V5.0
KuaiFanCMS V5.x hereinafter referred to as KF uses PHP5+MYSQL as the technical basis for development.KF is built with Smarty template engine. KuaiFanCMS V5.0 has a SQL injection vulnerability. An attacker can exploit the vulnerability to obtain sensitive information from the database...
WordPress SQL Injection Vulnerability (CNVD-2018-10476)
WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. WordPress suffers from an information disclosure vulnerability. By exploiting this vulnerability, an attacker can perform SQL...
Trend Micro Email Encryption Gateway SQL Injection Vulnerability (CNVD-2018-10480)
Trend Micro Email Encryption is a suite of identity-based email encryption solutions from Trend Micro, Inc. The Trend Micro Email Encryption Gateway TMEEG is one of the gateway products that provides data protection. A SQL injection vulnerability exists in the formRegistration2 class in Trend Mic...
SQL Injection Vulnerability in SMiCMS Government Website System v201803224 Version
State Micro CMS is one of the mainstream CMS systems in China, and is also the largest open source platform provider in the field of PHP in Southern China. State Micro CMS government website system v201803224 version of the existence of SQL injection vulnerability , attackers can exploit the...
Zhengzhou octave network marketing system has SQL injection vulnerability
Zhengzhou Octave Networks is a technology company that specializes in providing customers with mobile Internet development, high-end website construction, brand Internet marketing and related Internet-based application services. Zhengzhou Octave Network Marketing system has a SQL injection...
HPE iMC 7.3 - Remote Code Execution Exploit
Exploit for windows platform in category remote exploits Exploit Title: HPE iMC EL Injection Unauthenticated RCE Date: 6 February, 2018 Exploit Author: TrendyTofu Vendor Homepage: https://www.hpe.com/us/en/home.html Software Link:...
HPE iMC 7.3 Remote Code Execution
Exploit Title: HPE iMC EL Injection Unauthenticated RCE Date: 6 February, 2018 Exploit Author: TrendyTofu Vendor Homepage: https://www.hpe.com/us/en/home.html Software Link: http://h10145.www1.hpe.com/Downloads/SoftwareReleases.aspx?ProductNumber=JG747AAE&lang=en&cc=us&prodSeriesId=4176535 Versio...
HPE iMC 7.3 - Remote Code Execution (Metasploit)
HPE iMC 7.3 - Remote Code Execution Metasploit Exploit Title: HPE iMC EL Injection Unauthenticated RCE Date: 6 February, 2018 Exploit Author: TrendyTofu Vendor Homepage: https://www.hpe.com/us/en/home.html Software Link:...
HPE iMC 7.3 - Remote Code Execution (Metasploit)
Exploit Title: HPE iMC EL Injection Unauthenticated RCE Date: 6 February, 2018 Exploit Author: TrendyTofu Vendor Homepage: https://www.hpe.com/us/en/home.html Software Link: http://h10145.www1.hpe.com/Downloads/SoftwareReleases.aspx?ProductNumber=JG747AAE&lang=en&cc=us&prodSeriesId=4176535 Versio...
SQL Injection Vulnerability in Jinbao Technology's CMS Website Building System
Shanghai Jinbao Network Technology Co., Ltd. is a set of website construction, SEO optimization, network promotion, Shanghai website production, Shanghai SEO optimization, Shanghai network optimization, and many other network services as one of the integrated service-oriented professional network...
HPE Intelligent Management Center WmiConfigContent Expression Language Injection (CVE-2017-12526)
An Expression Language injection vulnerability exists in HPE Intelligent Management Center. The vulnerability is due to insufficient handling of request parameter on wmiConfigContent.xhtml...